Windows Explored

Process Explorer can often times give you clues to hung processes. Simply open the hung process and go to the Threads tab. Take this case here where Outlook was hanging and showing significant CPU usage while trying to send an email. I started by identifying the hung thread. In this case, CPU time and CSwitch Delta columns make this obvious. Select the thread and double-click it or click the Stack button to see the state of the stack. The stack reads from bottom to top. Look at the most recent frames for clues to the problem. In this case, mshtml.dll stands out:

If you were to, in fact, dump Outlook.exe in this state and examine with WinDbg from the Windows Debugging Tools, you would see that the stack in the dump looks similar to the stack in Process Explorer:


mshtml.dll is the Microsoft IE component for rendering web content. Outlook 2003 relies on mshtml.dll for rendering html formatted messages*.  I started testing by creating several emails and sending them. The message body remained blank except for one of our standard GT signatures. I noticed a trend quickly: messages that were blank sent fine, while those that contained a signature were getting hung. Removing the signature and adding random formatted text to the message also did not hang the email on send, which pretty much isolated the problem to the signature.

If the signature was the cause, then we should have been seeing this problem long before this point as the signatures had been deployed for some time now. However, I did notice a minor difference. The user had edited the standard signature to include text after the logo. This seems to be introducing some additional html that did not seem to be working well with some other component in Outlook.

Dissecting the user’s signature reveals nothing out of he ordinary when compared against an unmodified signature, except for the last bit where she includes “PLEASE NOTE OUR NEW ADDRESS”, which introduces some additional html tags, but nothing that should cause the signature to hang up the email when trying to send:

Curious still, I did some more troubleshooting. First, I wanted to see if I could recreate this by using one of these signatures myself and modifying it. Sure enough, I was able to recreate the hang. Next, I wanted to test the issue in Outlook safe mode. I could not recreate under any circumstances in safe mode.

So what was different about safe mode? To find out, I started Outlook normally and attached WinDbg to outlook.exe (File > Attach to a Process). I wanted to see what WinDbg could tell me what was loading when I hit send. When you connect to a process with WinDbg, you need to resume that process by running the g (Go) command or F5 so you can continue the process normally. It didn’t matter if I produced the hang or not the first time around, I just wanted to see what was loading:

You can see above the Microsoft spelling component, msspell3.dll, is loaded, which checks the email for spelling before sending. After opening Outlook in safe mode I found that the spell check option is not enabled, and hence not loaded, unless manually invoked through the menu or F7. If I manually ran the spell check in Outlook while in safe mode, I could get the message to hang, which told me it was not failing during send but during the completion of spell check and failing before passing the GUI message that spell check is complete. Knowing this, I correctly assumed that an email message that contains a modified signature but no unknown or misspelled words should send without getting hung.

The last testing involved using the company signatures on non-company systems with Outlook “out-of-the-box” and using both Exchange and POP3 profiles with a clean install of Windows XP (not an image). In all these cases, Outlook still became hung after running spell check. Hopefully, more to come.

*Outlook 2007/2010 no longer rely on IE or mshtml.dll for html content; rendering is handled by Office itself. Because of this, Outlook 2007/2010 is not affected.